CyberArk credential retrieval use cases - You can retrieve CyberArk credentials for these use cases: bootstrap, system, auto-login, and automation.

Retrieve Control Room bootstrap credentials with CyberArk

The Automation 360 Control Room uses bootstrap credentials to access supporting services such as database, service account, and Active Directory (AD). You configure these credentials during the initial On-Premises installation or post-installation (using the key vault utility) by specifying the safe name and object name.

The following images shows the process of retrieving the Control Room bootstrap credentials with CyberArk:

CyberArk Control Room bootstrap credential retrieval

When required during the bootup sequence or normal operations (such as refreshing a service authentication), the Control Room uses the key vault connection to retrieve the credential and perform the required authentication.

Note: You must select the Microsoft SQL Server Authentication for this use case; other database authentication methods are not supported for bootstrap.

Retrieve Control Room system credentials with CyberArk

Note: You can configure the service account only during the initial installation.

If you configured an external key vault during the initial installation, you can then use the Automation 360 user interface (post-installation) to configure SMTP and Active Directory (AD) credentials.

Log in to the Automation 360 Control Room.
Navigate to Administration > Settings > Email Settings.
You can map the AD primary account credential from the external key vault, configure external credentials, or set to manual (switch modes of AD primary account credential retrieval).

Retrieve auto-login credentials with CyberArk

Auto-login credentials authenticate to an Automation 360 Bot Agent device and start an active Windows session. Automation requires an active Windows session to function. Auto-login occurs before the automation runs when it is launched from a remote Bot Agent device.

The following image shows the process of retrieving the auto-login credentials with CyberArk:

CyberArk retrieve auto-login credentials

A Control Room administrator can manually launch or schedule a job to launch an automation on a Bot Agent device by specifying these details:

Automation (bot) name
Device name
User context

The system performs auto-login to the specified device with the user name and password associated with the user context, and then runs the automation on the device.

Note: In Automation 360 v.41 and later, device auto-login configuration is available through only one of the following paths, depending on the features enabled for your environment:

If the Manage > External Vault option is visible, configure device auto-login using this flow. This flow supports configuring auto-login for a selected external vault connection in environments that use one or more external vaults. See Option A: Auto-login under Manage given below.
If not, configure device auto-login using Administration > Settings > External key vault > Device auto login. See Option B: Auto-login under Settings given below.

Option A: Auto-login under Manage

Enable the device auto login settings to retrieve auto-login credentials from the CyberArk key vault and map the Control Room username with the secret name:

Note: In a multi-vault setup, each user account with unattended Bot Runner license can be mapped to only one vault connection where its credentials are stored. If no explicit mapping exists, the system checks for a connection with Automation 360 naming enabled or an updated connection. If neither is found, it falls back to device credentials. Ensure that each user account with Bot Runner license is mapped to the correct vault connection.

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Navigate to Manage > External Vault > Auto Login.
Click Add Auto login, Add or + icon.
From the Select vault drop-down list, choose one of your vault connections of CyberArk provider.
Under Auto login, Enabled is selected by default. Click Disabled if you want to disable auto login for this vault connection.
Note: If auto-login is disabled for this vault connection:
- The Safe name and Secret naming convention configuration options will not be available.
- If a user account with an unattended Bot Runner license is mapped to this external vault connection, credentials are retrieved using the device Credential Vault and its stored credentials instead.
Enter the Safe name (for example: Auto_login_Safe).
The safe name you enter is also known as the Auto-login Credential Safe. For safe name and object name formats, see External key vault naming conventions.
1. Optional: Enter the property set to your CyberArk username. For example, to configure the username in the format domain\username, you must enter: $$domain$$\$$username$$ where the values for domain and username are retrieved from the CyberArk secret response.
2. Optional: To add an optional safe, click Add optional safe, enter the Safe name, and then select roles. You can add up to 25 safes. For more information, see Using optional safes in CyberArk Password Vault integration.
Under Secret naming, select one of the following options: Custom or System (A360).
Custom: If you've selected this option, do the following
1. Click Next to open the Secret mapping page.
2. You can manage secret mappings in two ways - single entry or bulk entries.
  Single entry: Use this method to add a mapping directly in the custom secrets mapping table, without needing a CSV upload.
  1. Click + icon on top of the Secret mappings table.
  2. Enter the Username and Secret name.
  3. Click Add.
    Note: The system validates whether the entered username exists in the Control Room. If the username does not exist, an error is displayed and the entry is not saved.
  Bulk entries: Use this method to add multiple mappings simultaneously by importing a .CSV template file containing username and secret names mapping entries into the Control Room. You can also use this method for single-entry updates.
  1. Download the Custom Secrets Name Mapping Template.csv template and add the username, secret name in the format specified.
    Note: In the Automation 360 On-Premises deployments with Active Directory, prefix the username with domain. Example: domain\username.
  2. Click Import .csv.
  3. Browse to select the Custom Secrets Name Mapping Template.csv template file to map the Control Room usernames with the secret names.
    The imported Import .csv template must follow the specified format. You cannot use the exported mapping entries in Import .csv file to import new entries.
  4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
  5. Click Close to return to the list of auto-logins created.
System (A360): If you've selected this option, click Create Auto Login and skip the steps above for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See Auto-login naming conventions.
Note:
- You can optionally complete the secret mapping steps given above under the Custom option if you plan to switch to the Custom naming convention in the future.
- System (A360) supports only one auto-login configuration. For all new external vault connections, use the Custom option.

Option B: Auto-login under Settings

Note: Use this option only if Manage > External Vault path is not visible.

Task 1: Map the Control Room username with the secret name

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Navigate to Administration > Settings > External key vault > Device auto login.
Click Edit.
Under Configure secrets name, select one of the following: Automation 360 defined secrets naming or Custom secrets naming.
Automation 360 defined secrets naming: If you've selected this option, click Save changes and skip the below steps for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See External key vault naming conventions.
Note: You can optionally complete the secret mapping steps given below under the Custom secrets naming option if you plan to switch to the Custom secrets naming convention in the future.
Custom secrets naming: If you've selected this option, do the following:
1. Select Manage custom secrets mappings.
2. Download the Custom Secrets Name Mapping Template.csv template and add the username, secret name in the format specified.
  Note: In the Automation 360 On-Premises deployments with Active Directory, prefix the username with domain. Example: domain\username.
3. Click Import .csv and browse to select the Custom Secrets Name Mapping Template.csv template file to map the Control Room usernames with the secret names.
  The import Import .csv template must follow the specified format. You cannot use the exported mapping entries Import .csv file to import new entries.
4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
  You can now perform the following actions, as necessary:
  - Search bar to search and sort by secret name.
  - Import .csv to add or update the entries.
  - Export to .csv to export the mapped entries into a .csv format.
  - Delete checked items to remove multiple entries.
  - Refresh to refresh the updated entries.

Task 2: Enable device auto-login from CyberArk

After mapping the Control Room usernames with secret names, you can enable the device auto login settings to retrieve auto-login credentials from the CyberArk key vault, using the following procedure:

Note: You cannot enable auto-login for specific unattended Bot Runners by providing device credentials for them. Once key vault is configured, credentials for all unattended Bot Runners will be retrieved from the key vault. Make sure that each Bot Runner’s credentials are stored in the key vault to avoid a Secret not found error.

Navigate to Administration > Settings > External key vault > Device auto login
Click Edit.
Click Enabled to retrieve the auto-login credentials from that external key vault.
If this option is disabled, then the external key vault connection was not configured.
Note:
- If you disable auto-login from the external key vault, then credentials are retrieved using the AAI Credential Vault and its stored credentials instead.
- If your Control Room is using a device pool to retrieve auto-login credentials using CyberArk, ensure that the auto-login option is enabled on all the devices in the device pool. Otherwise, the auto-login credentials are not retrieved for devices that do not have the auto-login option enabled.
Enter the Safe name (for example: Auto_login_Safe).
The safe name you enter is also known as the Auto-login Credential Safe.
Note: For safe name and object name formats, see External key vault naming conventions.
Enter the property set to your CyberArk username. For example, to configure the username in the format domain\username, you must enter: $$domain$$\$$username$$ where the values for domain and username are retrieved from the CyberArk secret response.
To add an optional safe, click Add optional safe, enter the Safe name, and then select roles. You can add up to 25 safes. For more information, see Using optional safes in CyberArk Password Vault integration.
Click Save changes.
If successful, then the auto-login settings successfully saved message is displayed.

Auto-login naming conventions

If you selected the System (A360) under Secret naming, follow the auto-login naming convention described below.

system naming convention selected

The Control Room retrieves auto-login credentials based on the object naming convention within the external key vault. The Control Room searches for an object where the object name (the credential name in the external key vault) matches the Control Room username for which it is performing auto-login.

The prefix autologin_ is required if System (A360) naming convention is selected for CyberArk external key vault. The name of the auto-login credential in the external key vault must contain autologin_ followed by the Control Room username. In some cases, certain key vaults have restrictions on the characters that can be used in credential object names. Additionally, to support how different use cases encode credentials, Automation 360 requires that certain characters be reserved or encoded.

The following table lists examples of the object naming conventions expected in the Control Room:


Control Room username	Expected object name format
ABCD\user123	autologin_ABCD--user123
user123@rpa.abcd.com	autologin_user123-40-rpa-2e-abcd-2e-com

Note: For On-Premises customers using AD authentication, you must format auto-login usernames using the UPN format or domain\username postfix.

For auto-login credentials, keep these in mind:

The object name in the external key vault must contain autologin_ as a prefix.
The auto-login credential names must map to the Control Room username (login ID) for the credential being retrieved.
Some external key vaults have usage restrictions of certain characters, such as backslash (\) and ampersand (@) in the secret name (object name), and restrictions on how special characters are interpreted within API calls. If the user ID contains special characters, then you must encode the secret name (object name) in the external key vault using ASCII code character substitutions, as listed in the following table.


This character	Changes to this ASCII code character substitution
\ (backslash)	--
- (dash)	-2d-
_ (underscore)	-5f-
@ (ampersand)	-40-
. (period)	-2e-

Note: Except for the backslash being mapped to double dashes, the dash, period, underscore, and ampersand are mapped using their ASCII code bracketed in dashes.

CyberArk auto-login credential example

For this auto-login credential retrieval example, consider a Control Room user who wants to deploy a bot on a device as a specific user. This example uses the following details:

Automation (bot) name run on a device = ProcureToPayGeoEast
Agent device name = WinVDI1138
Agent user context = roboticworker2112@automation.abcd.com

The following image shows this an example of retrieving auto-login credentials with CyberArk:

CyberArk auto-login credential example

Before starting the automation, ensure the following:

The Control Room connection details have been successfully configured, and the Control Room uses these connection details to connect to CyberArk and performs authentication.
The Control Room queries the Bot Agent device running on device WinVDI1138 to check if there is an active Windows (operating system) session currently on device WinVDI1138, and if that session belongs to Agent user robiticworker2112.
If there is an existing session on the device for user robiticworker2112, then there is no need to perform auto-login and the bot continues with the deployment.
However, if there is an no active session or if there is an active session that does not belong to robiticworker2112, then the Control Room retrieves the auto-login credential from the CyberArk Password Vault.
The Control Room passes the credential (password) to theBot Agent. The Bot Agent performs a Windows login on device WinVDI1138 as robiticworker2112 (first, logging off any other user login session) using the auto-login credential for robiticworker2112. The automation (Bot) ProcureToPayGeoEast then starts to run on device WinVDI1138 as robiticworker2112.

Retrieve automation credentials with CyberArk

Automation credentials are variables used by bot developers within automation (bot) actions that define and retrieve data from encrypted storage. The automation uses the credentials to authenticate to applications (for example: finance application). Automation credentials are retrieved by the Automation 360 Bot Agent during runtime. Within CyberArk, a safe is a locker, and an object is a credential.

The following image shows the process of retrieving automation credentials with CyberArk:

CyberArk retrieving automation credentials

Automation credentials retrieved from the CyberArk Password Vault are mapped in the Automation Anywhere Credential Vault. The Credential Vault supports these two types of automation credentials:

Default credentials: Credentials where the value returned by the credential variable is the same for any automation that uses that variable.
Username - based credentials: Credentials where the value returned by the credential variable is distinct based on the user context in which the automation is running.

Note: You cannot enter dynamic values into Central Credential Provider (CCP) from a different user profile using a username - based credential option. The values and attributes remain static and are created within CyberArk Password Vault.

For both system credentials and user-defined credentials, the bot developer specifies the same credential variable within the bot code. Then, the system determines which credential to retrieve during bot runtime.

User-defined credentials simplify automation development by enabling bot developers to write code using a single credential variable where the RPA platform substitutes the value returned during runtime with a unique user-specific value. Developers can avoid writing duplicate code with different user-specific credential variables.

The following image shows the relationship between the Automation Anywhere Credential Vault objects and the CyberArk credentials for system and user-defined credentials:

Automation Anywhere and CyberArk mapped credentials

The Control Room locker (Locker1) is mapped to the CyberArk safe name (Safe1).
The Control Room system credential (Credential1) is mapped to the CyberArk object (Object1).

As an administrator, you create and configure a locker and credentials using the external key vault feature in the Automation 360 Control Room. Within the Control Room, an administrator maps the Automation Anywhere locker (Locker1) to a safe name (Safe1) and maps the credential (Credential1) to an object name (Object1). The credentials available to Control Room users are determined by what is configured in the external key vault (CyberArk Password Vault).

If you want to use user-defined credentials with the CyberArk integration, then the CyberArk administrator must create objects for each user-defined credential by naming those objects with the Control Room_username postfix. During runtime, the RPA platform retrieves the object name that is named with a postfix that matches the user context (user-defined credential) in which the automation is running. If there is no user-defined credential, then the RPA platform retrieves the object name without a username postfix (and uses the system credential).

Note: You can map any Automation Anywhere locker to any CyberArk Safe Name. However, any safe names you use to map automation credentials should be distinct from the safe names you use for auto-login.

As an administrator, you can use the access controls in the Automation 360 Control Room to separate access to credentials by providing users access to a locker. You control access to credentials by assigning different Control Room users to different roles and then associating different lockers with those roles. By mapping different CyberArk safes to different lockers, access to credentials in the CyberArk safes is mapped to and enforced by the access controls in the Control Room.

Note: The same permissions and privileges (assigned through roles) in the Control Room apply to credentials mapped to the external key vault.

CyberArk automation credentials retrieval procedure

To configure automation credentials retrieval and integrate with the CyberArk Password Vault, you first create a locker and then create credentials.

Note: If you want to store credentials in the Control Room credential vaults and external key vaults, do the following:

Create separate lockers in the Control Room to store credentials created in the Control Room credential vaults.
Create separate lockers in the Control Room to store credentials created in external key vaults.

The Control Room does not support storing credentials from the Control Room credential vaults and external key vaults in the same locker.

In Automation 360 v.41 and later, credential and locker management for external vaults are available through either of the following options, depending on the features enabled for your environment.

If the Manage > External Vault option is visible, use this flow for all external vault related activities, including creating and managing lockers and credentials. This flow is designed for environments that use one or more external vaults. See:
- Manage lockers for an external key vault connection
- Manage credentials for an external key vault connection
If not, use the Manage > Credentials flow to create lockers and credentials. See:
- Create locker
- Create credential

Note: When Manage > External Vault is visible, the Manage > Credentials option remains visible too. However, external vault related credential and locker creation options are no longer available through the Manage > Credentials flow.

CyberArk Password Vault automation object naming example

The following table shows CyberArk external key vault object naming examples using naming conventions for automation.

Note:

The Safe Name maps to the locker for the Control Room, and the Object Name maps to the credential for the Control Room.
The Object Name field in the Control Room maps to Account Name in CyberArk. Also, the object name should not contain any spaces. For example, if the Account Name in CyberArk is automation360-engsafe-example.com-john.smith, the Object Name field in the Control Room must be set to automation360-engsafe-example.com-john.smith.


Automation credential example	Control Room username	Safe Name	Object in locker
System credential in locker mapped to Safe Name	None - system credential	finance	glaccess
User-defined credential in locker mapped to Safe Name	ABCD\RPA\user123	finance	glaccess_ABCD--RPA--user123
User-defined credential in locker mapped to Safe Name where username is encoded with ASCII mapping	ABCD\RPA.user123	finance	glaccess_ABCD--RPA-2e-user123

Configure username for different Automation 360 services using the CyberArk secret response

When configuring CyberArk settings for some of the Automation 360 services such as auto-login, Lightweight Directory Access Protocol (LDAP), and service credentials, you can optionally configure the username for the Enter property set to your CyberArk username option. Usernames can be a combination of values from the secret response or string literals. The CyberArk secret response contains field values that you must enclose within dollar signs ($$) to construct the username. For example, to configure the username in the format domain\username, you must enter: $$domain$$\$$username$$. The domain and username values in this expression will be replaced with the corresponding values from the secret response.